hi need help with log file-cheers

Hello Harry,

Please move your hijackthis.exe out of a temporary folder and repost your hijackthis log. No back-ups will be made of hijackthis fixes if it is left in a temporary folder.

Hello Harry,

C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX03.671\HijackThis.exe

Please forgive me for being so picky but we need to be careful and have backups. Please see the following link.

http://russelltexas.com/malware/createhjtfolder.htm

really sorry about that! anyway ive saved it in c:/ and heres the log

ps:thanks for quick responses

Logfile of HijackThis v1.99.1
Scan saved at 8:52:51 PM, on 8/29/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\appmn32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\mfcql32.exe
C:\WINDOWS\System32\rundll32.exe
C:\program files\180searchassistant\sac.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\WINDOWS\Explorer.EXE
C:\Rar$EX01.422\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\osjqr.dll/sp.html#22048
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\osjqr.dll/sp.html#22048
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\osjqr.dll/sp.html#22048
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\osjqr.dll/sp.html#22048
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\osjqr.dll/sp.html#22048
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\osjqr.dll/sp.html#22048
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads1.revenue.net/r?site_id=13827&pplacement_id=1
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {1492CE6A-29F9-0C0F-D7AF-AA3B90ABB4CC} - C:\WINDOWS\javand.dll
O2 - BHO: Class - {F74BE206-1DFE-36CA-AD40-4E17A18DEFF4} - C:\WINDOWS\d3ci32.dll
O4 - HKLM\..\Run: [netsq32.exe] C:\WINDOWS\netsq32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [javaif.exe] C:\WINDOWS\javaif.exe
O4 - HKLM\..\Run: [mfcql32.exe] C:\WINDOWS\mfcql32.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [zwtglcn] C:\WINDOWS\zwtglcn.exe
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\RunServices: [atiupdpl] C:\WINDOWS\System32\atiupdpl.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [atiupdpl] C:\WINDOWS\System32\atiupdpl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17F5D97C-1CA6-45C8-A89A-FAAF42FEE5B2}: NameServer = 205.188.146.145
O17 - HKLM\System\CS1\Services\Tcpip\..\{17F5D97C-1CA6-45C8-A89A-FAAF42FEE5B2}: NameServer = 205.188.146.145
O17 - HKLM\System\CS2\Services\Tcpip\..\{17F5D97C-1CA6-45C8-A89A-FAAF42FEE5B2}: NameServer = 205.188.146.145
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appmn32.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Hello Harry,

Let's tackle the smitfraud infection first and then work on the others.  

Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Winsockxpfix

Download Winsockxpfix from

http://www.spychecker.com/program/winsockxpfix.html

Do Not use it yet!

If you encounter problems connecting to the Internect, run this Winsockxpfix. You may not even need to do this but I want you to be aware of this fix if for some reason you cannot connect after rebooting.

Locate the Winsockxpfix.exe and double click and click Run.

The VB_WinFix Win 1.2 window will appear.

Click Fix

Please revieiw how to see hidden files in Windows
How to see hidden files in Windows.

Next, please reboot your computer in SafeMode by doing the following:

1.      Restart your computer

2.      After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

3.      Instead of Windows loading as normal, a menu should appear

4.      Select the first option, to run Windows in Safe Mode.

Go to Add/Remove programs and remove(uninstall) the following, if present:

   NewDotNet

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

Run HiJackThis and click "Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\osjqr.dll/sp.html#22048

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\osjqr.dll/sp.html#22048

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\osjqr.dll/sp.html#22048

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\osjqr.dll/sp.html#22048

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\osjqr.dll/sp.html#22048

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\osjqr.dll/sp.html#22048

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads1.revenue.net/r?site_id=13827&pplacement_id=1

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {1492CE6A-29F9-0C0F-D7AF-AA3B90ABB4CC} - C:\WINDOWS\javand.dll

O2 - BHO: Class - {F74BE206-1DFE-36CA-AD40-4E17A18DEFF4} - C:\WINDOWS\d3ci32.dll

O4 - HKLM\..\Run: [netsq32.exe] C:\WINDOWS\netsq32.exe

O4 - HKLM\..\Run: [javaif.exe] C:\WINDOWS\javaif.exe

O4 - HKLM\..\Run: [mfcql32.exe] C:\WINDOWS\mfcql32.exe

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe

O4 - HKLM\..\Run: [zwtglcn] C:\WINDOWS\zwtglcn.exe

O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe

O4 - HKLM\..\RunServices: [atiupdpl] C:\WINDOWS\System32\atiupdpl.exe

O4 - HKCU\..\Run: [atiupdpl] C:\WINDOWS\System32\atiupdpl.exe

O9 - Extra button: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

O9 - Extra 'Tools' menuitem: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab

O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing)

O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appmn32.exe

Now, with all windows closed except HiJackThis, click "Fix checked".ere if needed.

folders...

   C:\program files\180searchassistant

   C:\PROGRA~1\NEWDOT~1

   C:\Program Files\PSGuard

files...

   C:\WINDOWS\system32\appmn32.exe

   C:\WINDOWS\mfcql32.exe

   C:\WINDOWS\osjqr.dll

   C:\WINDOWS\javand.dll

   C:\WINDOWS\d3ci32.dll

   C:\WINDOWS\netsq32.exe

   C:\WINDOWS\javaif.exe

   C:\WINDOWS\zwtglcn.exe

   C:\WINDOWS\System32\atiupdpl.exe

-

Note that some of these file(s) may or may not be present

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.
• You will need to step through the process of cleaning files one-by-one.
• If ewido detects a file you KNOW to be legitimate, select none as the action.
• DO NOT select "Perform action on all infections"
• If you are unsure of any entry found select none for now.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop

Close Ewido

Reboot back into Windows and  go to Panda ActiveScan and do a full system scan. Make sure the autoclean box is checked!

wow, it looked like there was some serious cleaning going on. Anyway here is the panda active report:

Incident                      Status                        Location                                                                                                                                                                                                                                                       

Adware:Adware/Apropos         No disinfected                C:\Documents and Settings\All Users\Documents\waqaas1\Local Settings\Temp\AutoUpdate0\setup.inf                                                                                                                                                                
Adware:Adware/CWS.Aboutblank  No disinfected                C:\Documents and Settings\All Users\Documents\waqaas1\Local Settings\Temp\sp.html                                                                                                                                                                              
Virus:Exploit/ByteVerify      Disinfected                   C:\Documents and Settings\Waqaas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-475707b3-104377aa.zip[Dummy.class]                                                                                                                     
Adware:adware/popuper         No disinfected                C:\Documents and Settings\Waqaas\Favorites\Anti Spam.url                                                                                                                                                                                                       
Adware:adware/cws             No disinfected                C:\Documents and Settings\Waqaas\Favorites\Online Gambling\Online Gambling.url                                                                                                                                                                                 
Adware:adware/searchaid       No disinfected                C:\Documents and Settings\Waqaas\Favorites\Only secks website.url                                                                                                                                                                                                
Spyware:spyware/petro-line    No disinfected                C:\Documents and Settings\Waqaas\Favorites\Sites about\Ab scissor.url                                                                                                                                                                                          
Adware:Adware/nCase           No disinfected                C:\Documents and Settings\Waqaas\Local Settings\Temp\180sainstallernusac.exe                                                                                                                                                                                   
Adware:Adware/eZula           No disinfected                C:\Documents and Settings\Waqaas\Local Settings\Temp\Advtg.exe                                                                                                                                                                                                 
Spyware:Spyware/New.net       No disinfected                C:\Documents and Settings\Waqaas\Local Settings\Temp\NNCLXA638.EXE                                                                                                                                                                                             
Possible Virus.               No disinfected                C:\Documents and Settings\Waqaas\My Documents\internet \software \unlocker.zip[GTCLwin.exe]                                                                                                                                                            
Dialer:Dialer.ABR             No disinfected                C:\Documents and Settings\Waqaas\My Documents\spyware remover\hijackthis\backups\backup-20050615-203450-433.inf                                                                                                                                                
Adware:Adware/PurityScan      No disinfected                C:\Documents and Settings\Waqaas\My Documents\spyware remover\hijackthis\backups\backup-20050615-203450-958.inf                                                                                                                                                
Adware:Adware/MediaTickets    No disinfected                C:\Documents and Settings\Waqaas\My Documents\spyware remover\hijackthis\backups\backup-20050615-203508-490.inf                                                                                                                                                

 ewido part4

C:\WINDOWS\adddv32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\aolback.exe.lnk:dapxke -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\apiek.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\appev.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\appov32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\atlec32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\Blue Lace 16.bmp:diidbp -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\clock.avi:hbgycm -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\Coffee Bean.bmp:wkqonc -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\d3ty32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\DtcInstall.log:olitpe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\enchp.dat:fnbvyj -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\FaxSetup.log:xnmbsu -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\Gone Fishing.bmp:jmpmwz -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\gsvdiag.log:dphccw -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\ietd32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\ipvj32.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\iSnooker.INI:hqhoze -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\javamg.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\javand.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\javatz32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\KB842773.log:sjsgvz -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\KB888113.log:ljauwt -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\KB888113.log:wjqgcv -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\KB888302.log:inmfia -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\KB890175.log:ejtayd -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\KB890859.log:pkblef -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\KB891781.log:bbdwwy -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\KB897715-OE6SP1-20050503.210336.log:flmdbs -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\KB897715-OE6SP1-20050503.210336.log:vsbnjx -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\keylog.gzs:csyjfk -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\keylog.gzs:qfpwym -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\LUINSTALL.LOG:afusls -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\LUINSTALL.LOG:ifibsp -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\mabfh.dat:tvlbhy -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\msbc.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\msdfmap.ini:yclmjy -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\msfi32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\msgsocm.log:hyfwva -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\msne32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\msny32.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\NDNuninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup
 C:\WINDOWS\netcn.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\netfxocm.log:szpbpk -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\netgk32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\netzi.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\ntdtcsetup.log:chscyu -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\ocmsn.log:fmbumn -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\regopt.log:jfylh -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\regopt.log:ynfwew -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\River Sumida.bmp:vpzovm -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\River Sumida.bmp:vuhxzf -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\Santa Fe Stucco.bmp:kmevml -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\SchedLgU.Txt:oqrtpw -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\sdksv32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\sessmgr.setup.log:mgjdd -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\setupact.log:xounro -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\setuperr.log:zjvmlj -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\Soap Bubbles.bmp:bimtsa -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\Soap Bubbles.bmp:goztdi -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\Soap Bubbles.bmp:ppnsmq -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\Sti_Trace.log:rknrnt -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\sysny.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\system32:bcaa.dll -> TrojanDownloader.Small.azk : Cleaned with backup
 C:\WINDOWS\system32\addmu32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\system32\apprr32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\system32\crkc.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\system32\d3vz32.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\system32\ieyy32.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\system32\ipjh32.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\system32\mfcte.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\system32\netha32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\system32\oleadm.dll -> Trojan.Agent.eo : Cleaned with backup
 C:\WINDOWS\system32\sysoh32.exe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\system32\windy.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\system32\wintt.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\tabletoc.log:lfpymm -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\Thumbs.db:yqsjol -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\twain.bin:ejyshs -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\updspapi.log:eghdoo -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\uvjyc.log:qrcpjo -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\vb.ini:wjqgcv -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\vdrey.log:hllbek -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\vminst.log:ltfuee -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\winamp.ini:qofnuo -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\winamp.ini:zidbfl -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\WindowsUpdate.log:qrpjyv -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\Wininit.ini:psgpjb -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\winnt256.bmp:irzxsx -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\winnt256.bmp:opgvkx -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\winset.ini:htzvlm -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\winset.ini:igntsi -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\winset.ini:kbgubg -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\WMSysPr9.prx:hqyamz -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\WMSysPrx.prx:qftput -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\wwdslcfg.log:aglvow -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\wwdslcfg.log:jkxiel -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\wwdslcfg.log:vxzxtx -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\Zapotec.bmp:kbfqy -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\Zapotec.bmp:nqscnh -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:bwhkav -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:cmxzyt -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:fnllxl -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:hmtzjp -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:horkis -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\_default.pif:jgphjw -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:jwoffk -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:jxxlva -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\_default.pif:kleldi -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:laxsqu -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:lpyqhf -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:mmtgci -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:ojbysf -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\_default.pif:olitpe -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:pbkljo -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:pjebyv -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\_default.pif:qsoadf -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:tyznr -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\_default.pif:tyznrm -> TrojanDownloader.Agent.bc : Cleaned with backup
 C:\WINDOWS\_default.pif:vdibv -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:wacff -> TrojanDownloader.Agent.bq : Cleaned with backup
 C:\WINDOWS\_default.pif:wbaygd -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:ybzzyf -> Spyware.SearchPage : Cleaned with backup
 C:\WINDOWS\_default.pif:ysvvju -> Trojan.Agent.bi : Cleaned with backup
 C:\WINDOWS\_default.pif:zceqoa -> Trojan.Agent.bi : Cleaned with backup

::Report End

And ere is the smitfiles

  smitRem log file
    version 2.3

    by noahdfear

The current date is: Tue 08/30/2005
The current time is:  7:02:22.56

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ShudderLTD key present! Running LTDFix!

ShudderLTD key was successfully removed! :)

 Pre-run Files Present

 ~~~ Program Files ~~~

Virtual Maid

 ~~~ Shortcuts ~~~

 ~~~ Favorites ~~~

 ~~~ system32 folder ~~~

oleadm.dll
wp.bmp

 ~~~ Icons in System32 ~~~

 ~~~ Windows directory ~~~

 ~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  Post-run Files Present

 ~~~ Program Files ~~~

 ~~~ Shortcuts ~~~

 ~~~ Favorites ~~~

 ~~~ system32 folder ~~~

oleadm.dll

 ~~~ Icons in System32 ~~~

 ~~~ Windows directory ~~~

 ~~~ Drive root ~~~

 ~~~ Wininet.dll ~~~

wininet.dll INFECTED!! :( Starting replacement procedure.

~~~~ Looking for C:\WINDOWS\system32\dllcache\wininet.dll ~~~~

~~~~ C:\WINDOWS\system32\dllcache\wininet.dll Present! ~~~~

~~~~ Checking dllcache\wininet.dll for infection ~~~~

~~~~ dllcache\wininet.dll Clean! ~~~~

 ~~~ Replaced wininet.dll from dllcache ~~~

 ~~~ Upon reboot ~~~

wininet.old present!
oleadm.dll not present!
oleext.dll not present!

 ~~~ Upon completion ~~~

wininet.old not present!
oleadm.dll not present!
oleext.dll not present!

~~~~ Rechecking C:\WINDOWS\system32\wininet.dll for infection ~~~~

~~~~ C:\WINDOWS\system32\wininet.dll Clean! :) ~~~~

thats t i think, really appreciate it. Thats one thing of my santas list! Wil inform you if any problems!

ewido part3

C:\RECYCLER\NPROTECT\00130122.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130125.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130128.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130131.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130137.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130138.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130141.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130145.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130147.TXT -> Spyware.Cookie.Bluestreak : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130365.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130366.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130367.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130368.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130369.TXT -> Spyware.Cookie.counter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130400.TXT -> Spyware.Cookie.Mediaplex : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130402.TXT -> Spyware.Cookie.counter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130403.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130408.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130409.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130410.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130624.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130625.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130736.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130737.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130738.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130739.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130740.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130747.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130748.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130749.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130750.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130751.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130776.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130777.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130778.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130779.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130782.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130783.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130784.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130785.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130786.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130787.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130814.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130815.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130818.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130819.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130842.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130843.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130844.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130846.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130847.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130848.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130849.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130850.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130851.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130852.TXT -> Spyware.Cookie.Tribalfusion : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130853.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130854.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130855.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130856.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130857.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130858.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130859.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130860.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130863.TXT -> Spyware.Cookie.Bfast : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130864.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130866.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130867.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130868.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130869.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130870.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130871.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130872.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130873.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130874.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130875.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130876.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130877.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130878.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130881.TXT -> Spyware.Cookie.Mediaplex : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130885.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130886.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130887.TXT -> Spyware.Cookie.Tribalfusion : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130888.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130891.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130895.TXT -> Spyware.Cookie.Falkag : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130896.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130898.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130899.TXT -> Spyware.Cookie.Bfast : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130901.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130903.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130904.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131019.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131020.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131070.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131071.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131084.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131094.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131111.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131115.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131116.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131215.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131216.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131217.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131218.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131219.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131220.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131221.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131222.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131223.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131224.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131225.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131226.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131274.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131275.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131276.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131300.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131301.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131302.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131340.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131576.TXT -> Spyware.Cookie.Paycounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131577.TXT -> Spyware.Cookie.Paycounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131578.TXT -> Spyware.Cookie.Paycounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131581.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131582.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131583.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131584.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131585.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131586.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131587.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131588.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131589.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131590.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131591.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131599.TXT -> Spyware.Cookie.Bfast : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131600.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131602.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131605.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131606.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131607.TXT -> Spyware.Cookie.Mediaplex : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131609.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131611.TXT -> Spyware.Cookie.Paycounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131614.TXT -> Spyware.Cookie.Clickzs : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131616.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131621.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131625.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131626.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131627.TXT -> Spyware.Cookie.Atdmt : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131629.TXT -> Spyware.Cookie.Statcounter : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131630.TXT -> Spyware.Cookie.Bfast : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131631.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00131633.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133498.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133499.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133500.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133501.TXT -> Spyware.Cookie.Doubleclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133502.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133503.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133507.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133508.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133509.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133510.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133511.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133512.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133513.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00133514.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

 ewido report part2

 C:\RECYCLER\NPROTECT\00129381.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129382.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129383.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129384.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129385.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129386.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129387.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129388.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129389.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129390.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129394.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129395.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129396.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129397.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129404.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129408.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129412.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129413.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129414.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129415.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129416.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129420.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129421.TXT -> Spyware.Cookie.Fastclick : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129422.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129423.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129424.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129425.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129426.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129427.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129430.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129436.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129437.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129444.TXT -> Spyware.Cookie.Bluestreak : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129445.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129446.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129447.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129455.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129456.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129457.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129458.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129459.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129460.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129461.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129462.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129554.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129555.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129556.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129784.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129785.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129786.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129789.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129790.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129800.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129801.TXT -> Spyware.Cookie.2o7 : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129803.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129804.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129806.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129807.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129808.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129809.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129811.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129812.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129813.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129815.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129816.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129817.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129818.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129860.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129861.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129862.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129863.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129864.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129865.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129866.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129871.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129872.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129873.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129874.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129875.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129876.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129877.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129878.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129879.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129880.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129881.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129882.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129883.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129884.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129885.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129886.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129889.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129890.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129891.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129892.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129893.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129894.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129895.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129897.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129898.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129899.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129928.TXT -> Spyware.Cookie.Questionmarket : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129929.TXT -> Spyware.Cookie.Questionmarket : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129982.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129983.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129984.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129985.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129986.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129987.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129989.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129990.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129991.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129992.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129993.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129994.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129996.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129997.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129998.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00129999.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130000.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130001.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130002.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130005.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130006.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130009.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130010.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130011.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130012.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130013.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130014.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130015.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130016.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130017.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130018.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130019.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130020.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130031.TXT -> Spyware.Cookie.Questionmarket : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130032.TXT -> Spyware.Cookie.Questionmarket : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130033.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130034.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130035.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130036.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130091.TXT -> Spyware.Cookie.Mediaplex : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130095.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130099.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130101.TXT -> Spyware.Cookie.Hitbox : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130108.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130109.TXT -> Spyware.Cookie.Advertising : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130111.TXT -> Spyware.Cookie.Tradedoubler : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130115.TXT -> Spyware.Cookie.Adserver : Cleaned with backup
 C:\RECYCLER\NPROTECT\00130116.TXT -> Spyware.Cookie.Questionmarket : Cleaned with backup
 

Hi Harry,

We made progress but we are not through yet! You are doing a wonderful job though!

First of all I need you to download some programs for use later.
Download this file and unzip it to your desktop
Download About:Buster from here. Once it is downloaded extract it to c:\aboutbuster and check for updates. Do NOT use it yet
Download CWShredder from here, install it, check for updates but again, don't use it yet.

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Show hidden files and folders.
• Uncheck the Hide protected operating system files (recommended) option.
• Click Yes to confirm.
• Click OK.

Now find and delete these files, if you can't find one then don't worry.. just move on to the next one.

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

files...

   C:\WINDOWS\nlxen.dll

   C:\WINDOWS\bzcur.dll

   C:\WINDOWS\system32\addtq32.exe

-

Run HiJackThis and click "Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\nlxen.dll/sp.html#22048

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\nlxen.dll/sp.html#22048

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bzcur.dll/sp.html#37049

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\nlxen.dll/sp.html#22048

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {6ECDB36B-1205-5DE1-F02E-335C36B4124F} - C:\WINDOWS\netgk32.dll (file missing)

O2 - BHO: Class - {894CE623-CF52-CC5D-EAE4-AE8C6849B369} - C:\WINDOWS\system32\wintt.dll (file missing)

O4 - HKLM\..\Run: [addtq32.exe] C:\WINDOWS\system32\addtq32.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

   ...(Unless you've set these with a anti-spyware program like SpyBot's Immunize feature, have HiJackThis fix this.)

O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - D:\CDS300\__CDS2.dll (file missing)

Now, with all windows closed except HiJackThis, click "Fix checked".

The following step is important as you may have several malware files in your temp directories.
Then browse to the C:\documents and settings\Your User Name (repeat for all other user names in documents and settings)\local settings\temp folder and delete all files and folders in it. Then browse to the C:\Window\Temp folder and delete all files and folders in it. Then in internet explore click tools>internet Options>General. Click on Delete Files make sure you get all offline content as well.